Skip to content

Commit

Permalink
net: __skb_flow_dissect() must cap its return value
Browse files Browse the repository at this point in the history
After Tom patch, thoff field could point past the end of the buffer,
this could fool some callers.

If an skb was provided, skb->len should be the upper limit.
If not, hlen is supposed to be the upper limit.

Fixes: a6e544b ("flow_dissector: Jump to exit code in __skb_flow_dissect")
Signed-off-by: Eric Dumazet <[email protected]>
Reported-by: Yibin Yang <[email protected]
Acked-by: Alexander Duyck <[email protected]>
Acked-by: Willem de Bruijn <[email protected]>
Acked-by: Alexei Starovoitov <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
  • Loading branch information
Eric Dumazet authored and davem330 committed Nov 13, 2016
1 parent 79774d6 commit 34fad54
Showing 1 changed file with 8 additions and 3 deletions.
11 changes: 8 additions & 3 deletions net/core/flow_dissector.c
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,7 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
struct flow_dissector_key_keyid *key_keyid;
bool skip_vlan = false;
u8 ip_proto = 0;
bool ret = false;
bool ret;

if (!data) {
data = skb->data;
Expand Down Expand Up @@ -549,12 +549,17 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
out_good:
ret = true;

out_bad:
key_control->thoff = (u16)nhoff;
out:
key_basic->n_proto = proto;
key_basic->ip_proto = ip_proto;
key_control->thoff = (u16)nhoff;

return ret;

out_bad:
ret = false;
key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen);
goto out;
}
EXPORT_SYMBOL(__skb_flow_dissect);

Expand Down

0 comments on commit 34fad54

Please sign in to comment.